Splunk Search

Create a time series graph after a stats command

jamesboustead
Explorer

Hi,

I'm not able to create a timechart graph for the below search, it is coming up with no result.

My current search is as below:

"My search 

| stats count by xxx

| xxx = xxx * count

| stats sum(xxx) as "yyy"

"

 

This search gives the the correct total but only relating to the time range picker, how would I manipulate the query to get a time series graph by the sum of each day?

Labels (3)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Since I don't know your data I tried to convert your search  to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.

| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Since I don't know your data I tried to convert your search  to timechart. I think xxx field is not a numeric field, so eval calculation is returning null value. I don't know your use case but below sample should work.

| timechart span=1d count by xxx
| eval xxx = 5 * count
| timechart span=1d sum(xxx) as yyy
If this reply helps you an upvote and "Accept as Solution" is appreciated.

scelikok
SplunkTrust
SplunkTrust

Hi @jamesboustead,

Since your search has no _time field on group by. "timechart" command use _time field for group by.

Please try below as a sample;

| timechart span=1d count by xxx
| eval xxx = xxx * count
| timechart span=1d sum(xxx) as yyy

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

jamesboustead
Explorer

This is now giving me two columns:

- one for "_time" which is split up daily which is good.

- one for 'yyy' but unfortunately this has no values underneath the column.

 

Please can you advise on how to get the value underneath 'yyy' corresponding to each day in the '_time' column?

 

Thank you

0 Karma

saravanan90
Contributor

We can use timechart command. 

index=_internal
| timechart span=1d count

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...